Privacy Policy

1. Who we are and what this covers

Aperta is run by Aperta (“we,” “us” or “our”). This policy explains what personal information we collect on the Aperta website and its features (the “Services”), why, and what you can do about it. “Personal information” means anything that identifies you or could reasonably be linked to you.

It does not cover the websites of the companies we describe, or other sites we link to. Their own policies apply there.

2. What involves no personal data

Most of the site uses only public information about companies:

• Company cards. What a company does and how it makes money, written by AI from public sources: SEC filings, GLEIF, USAspending.gov, the company's own website, and Wikipedia for background. Each card has a market section with a preview of the company's market map, who pays the company and who it pays, and a sign-up for early access to market maps. A link is shown only when a filing or the company's own site names it.
• Money threads on the homepage. A small drawing of payments between big companies, each quoted from SEC filings.

Public sources can name the people who lead a company. We use that only to describe the company. When a company is put in line, we keep only its website and how many times it was asked for, not who asked.

3. What we collect

What you give us

• Corrections. When you use “Something wrong?” on a card, we collect your email, the correction, whether you confirmed your email with the 6-digit code we sent, and whether the email belongs to the company's domain (a work email marks the correction as from the company).
• Market map questions. When you type a market question, we show an instant preview built from cards we already have. If you sign up for early access, we store the question with your sign-up. For maps we have built, the question is stored with the map and appears on the map's page. Please don't type personal information into it.
• Buying a market map, when paid maps open. Paid maps are not open yet. Once they are, Stripe runs the checkout page and collects your payment details under its own privacy policy. We never see your card number. Stripe gives us your email once so we can email you the link to your map. We don't store that email. See Payments and Stripe below.
• Market maps early access. If you ask for early access to market maps, we keep your email, the markets you asked about, whether you confirmed by clicking our link, and where on the site you signed up. We only use it to tell you when market maps open, and to count how many people ask about each market. We never show that count. Every email has a one-click unsubscribe, and unsubscribing deletes your address and everything saved with it.
• “Email me when checkout opens.” If you ask us, on a finished map, to tell you when checkout opens, we keep your email and the id of that map. We use it once, to tell you, and then delete it.
• “Email me when it's ready.” If a company is in line and you ask us to tell you when its card is ready, we send a confirmation right away and one more email when the card is ready, then delete your address. If the card isn't ready within 14 days, we delete it anyway.
• Messages. When you use our contact form, we collect your name, email, the topic you choose and your message.
• Other early access requests. When you ask through our contact form for early access to Aperta for AI, or to be first to verify your company, we keep your name, email and what you tell us about your project or company as a message, only to reply and tell you when it opens.
• API keys. There is no public API yet. We may issue keys by hand to early access builders. For each key we keep the key holder's label (a name or project), email, and how many calls the key makes each day.
• Past company verification requests. Company verification is closed to new requests. If you asked to verify a company before it closed, we keep the details you gave us (such as your work email, name and job title) until you ask us to delete them. Requests that never finished are kept up to 12 months.

What we collect automatically

• Server logs. Our hosting provider records standard technical details for each visit: IP address, browser type, pages requested, the referring page, and the date and time.
• Abuse limits. We use your IP address to limit how many requests one visitor can make. These counters expire within 2 days.
• Free market maps. Each visitor can open 3 finished market maps a day for free. To count them, we store a hash (a scrambled version) of your IP address, never the address itself. The count is deleted after 2 days.
• Recent companies. Your browser keeps a short list of companies you opened, so the search box can show them. It stays on your device and is never sent to us.
• Analytics, only if you allow it. We record which pages you view, the companies you open and search for, which features you use and where you click, how you arrived, your device and browser, approximate location from your IP address, and a replay of your visit. Replays hide every form field and anything you type. All of it is tied to a random identifier, never your name or email, and we never join it to the emails you give us. See our Cookie Policy.

We don't ask you to create an account, and we don't knowingly collect sensitive personal information.

4. Payments and Stripe

Paid market maps are not open yet. This section applies once they are.

• Stripe processes your payment (card or Apple Pay) on its own hosted checkout page. You don't make an account with us.
• We never see or store your card number. Stripe sends its own receipt.
• Stripe may save your card for future purchases (Stripe calls this setup for future use), so the same card can pay for later purchases. We never charge it unless you make a new purchase.
• We get your email from Stripe once, to email you the map's link, and we don't store it.
• Your browser gets a cookie called aperta_maps that holds the access keys for maps you bought. Scripts on the page can't read it, and it lasts 1 year. The link we email you also contains a key, so the map opens on any device.

5. How we use it

• To run, fix and improve the Services.
• To review corrections, confirm who sent them, and update company cards.
• To send the emails you ask for: a confirmation code, a note when market maps open, a note that a company is in line or its card is ready, a note when checkout opens, the link to a map you bought once paid maps open, and early access news.
• To show market map previews, build finished maps, give you access to maps you bought once paid maps open, and count free maps and API key use.
• To reply to messages and handle requests about past company verification.
• To prevent spam, fraud, abuse and security problems.
• With your consent, to see how the Services are used through analytics and session replays.
• To count which links bring people to the site: anonymous daily totals by source (for example X, LinkedIn or a shared card), with no cookie. When you join an email list, we note the kind of link that brought you, like “x” or “share”, and nothing else about your visit.
• To follow the law and enforce our Terms of Use.

6. Legal bases for visitors in the EEA and UK

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Consent for analytics cookies. You can withdraw it at any time.
• Contract for delivering a market map you bought and handling refunds, once paid maps open.
• Legitimate interests for running and securing the Services, preventing abuse, reviewing corrections and replying to messages.
• Legal obligation where the law requires us to keep or disclose information.

7. Who we share it with

We share personal information only in these cases:

• Service providers that run parts of the Services for us under contract: Vercel (hosting and logs), Upstash Redis (database), Google Workspace (sending and receiving email), Stripe (payments for market maps, once paid maps open) and, only if you allow analytics cookies, PostHog (analytics).
• AI provider. An AI model provider writes company cards and builds finished market maps. It processes public-source text and, when we build a map, the market question behind it, and may run web searches to find candidate companies. Previews you see are built from existing cards, not by AI. We don't send it your email, messages or corrections.
• Content services. Jina helps us read company websites and receives only those web addresses. Company logos are fetched by our servers from each company's own website or our logo provider (logo.dev) and served from our domain, so those services never see your visit. On some cards your browser loads homepage screenshots from Microlink, which receives your IP address and browser details, as with any web request. Fonts and photos are served from our own domain.
• Legal and safety. When we believe in good faith the law requires it, or it is needed to protect the rights, property or safety of us, our users or others.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, and still subject to this policy.
• With your consent or at your direction.

We never sell personal information, and we don't share it for cross-context behavioral advertising.

8. Cookies

We use strictly necessary cookies, and analytics cookies only if you allow them. You can change your choice at any time through Cookie settings in the footer. Details are in our Cookie Policy.

9. How long we keep it

• Abuse counters and the hashed IP address used to count free market maps: up to 2 days.
• Market map questions: kept with your early access sign-up, or with a built map for as long as the map exists. They hold no personal information unless someone types it in.
• Buyer emails from Stripe: not stored. Stripe keeps its own records under its privacy policy.
• Market map access keys: in your browser's aperta_maps cookie for 1 year, and in the link we emailed you.
• Market maps early access sign-ups: until you unsubscribe, which deletes them. Sign-ups never confirmed: deleted after 12 months.
• “Email me when checkout opens” emails and the map id: deleted after we tell you checkout is open.
• “Email me when it's ready” emails: deleted after the card-ready email, and no later than 14 days.
• Corrections and confirmed emails: until you ask us to delete them, or we no longer need them to maintain company cards.
• Contact messages: until we have handled them, and no longer than 24 months.
• Early access requests sent through the contact form: kept like contact messages, or until you ask us to remove you.
• Details from past company verification requests: until you ask us to delete them. Requests that never finished: up to 12 months.
• Read counts for each card, counted by week (by people and by AI agents): up to 10 weeks, with no personal information.
• Daily totals (card opens, new companies explained): kept without any personal information.
• Analytics data, including session replays: up to 12 months (replays are usually kept for less time, as set by our analytics provider).
• Server logs: as set by our hosting provider, usually days to weeks.

10. Your rights and choices

Everyone. You can ask us what personal information we hold about you, and ask us to correct or delete it. We will not treat you differently for asking.

Cookies. You can accept, reject or change analytics cookies at any time through Cookie settings. We treat a Global Privacy Control signal from your browser as a request to opt out of analytics.

US states. Depending on where you live, including California, Colorado, Connecticut, Virginia and other states with privacy laws, you may have the right to know what personal information we hold about you, get a copy of it, correct it, delete it, and opt out of its sale or use for targeted advertising (we do neither). You may use an authorized agent, and you may appeal if we turn down your request.

EEA and UK. You also have the right to restrict or object to how we use your information, to get it in a portable format, and to complain to your local data protection authority.

How to ask. Contact us at privacy@askaperta.com. We may need to confirm it's you, usually by emailing the address the request is about. We respond within the time the law requires.

11. Children

The Services are not meant for children under 13, or under 16 in the EEA and UK, and we don't knowingly collect their personal information. If you think a child has given us personal information, contact us and we will delete it.

12. Security

We use reasonable safeguards, including encryption in transit, restricted access, and confirmation codes that are hashed and expire quickly. No system is completely secure, so we can't promise perfect security.

13. International transfers

We are based in the United States, and our service providers process information in the United States and other countries. Where required, we use safeguards such as the European Commission's Standard Contractual Clauses for transfers out of the EEA and UK.

14. Other websites

Cards and maps link to company websites, SEC filings and other sources. We are not responsible for what those sites do with your information.

15. Changes to this policy

If we change this policy, we will update the date at the top. For important changes, we will post a notice on the Services before they take effect.

16. Contact us

Questions or requests about this policy can be sent to Aperta at privacy@askaperta.com.